A1 Capital

A1 Capital was compromised in a ransomware attack attributed to dragonforce in February 2026. The organization, operating in an undisclosed sector in TR, was added to the group's data leak site as part of an extortion campaign.

dragonforce operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

A1 Capital offers specialized solutions in various fields of capital markets, including equity, Eurobond, Futures and Options (Viop), investment consultancy, portfolio management, and public offerings. The company aims to serve clients looking for comprehensive financial services and personalized investment strategies. They provide various platforms and tools for trading and investment analysis. A1 Capital also runs promotional campaigns to enhance investor experience and engagement.

Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2025-5777, which may have been leveraged as initial access vectors or for lateral movement.